CVE-2026-15527: better-auth better-icons Path Traversal

CVE-2026-15527 Overview

CVE-2026-15527 is a path traversal vulnerability [CWE-22] affecting better-auth/better-icons up to version 1.0.5. The flaw resides in the scan_project_icons/sync_icon component, where the icons_file argument is not properly sanitized. An authenticated local attacker can manipulate this argument to reference files outside the intended directory.

The exploit has been publicly disclosed. According to VulDB, the project maintainers were notified through an issue report but have not responded at the time of publication. The vulnerability requires local access and low privileges, limiting practical exploitation scenarios.

Critical Impact
Local attackers with low privileges can read or reference files outside intended directories by supplying crafted icons_file values to the sync_icon function.

Affected Products

better-auth/better-icons versions up to and including 1.0.5
Component: scan_project_icons/sync_icon
Argument affected: icons_file

Discovery Timeline

2026-07-13 - CVE-2026-15527 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15527

Vulnerability Analysis

The vulnerability is a path traversal weakness classified under [CWE-22]. It occurs in the sync_icon routine within the scan_project_icons component of better-auth/better-icons. The component accepts an icons_file argument that is used to construct a file system path without adequate validation.

Because the input is not normalized or restricted to a base directory, an attacker can inject traversal sequences such as ../ to escape the intended icons directory. This allows references to arbitrary files on the local filesystem within the privileges of the running process.

Exploitation requires local access and low-level privileges. No user interaction is needed, and attack complexity is low. The scope remains within the process boundary, and confidentiality, integrity, and availability impacts are limited.

Root Cause

The root cause is missing input validation on the icons_file argument. The function concatenates or resolves the user-controlled string into a file path without enforcing a canonical base directory or rejecting traversal metacharacters such as .. and absolute path prefixes.

Attack Vector

An attacker with local access invokes the sync_icon function and supplies an icons_file value containing traversal sequences. For example, providing a value that resolves upward through the directory tree causes the routine to operate on a file outside the intended icons directory. The vulnerability is documented in the GitHub Issue #18 Discussion and cataloged in the VulDB CVE-2026-15527 Entry.

No verified proof-of-concept code is available in the referenced advisories. Refer to the linked issue tracker for technical context.

Detection Methods for CVE-2026-15527

Indicators of Compromise

File access events originating from the better-icons process that reference paths outside the configured icons directory.
Presence of traversal sequences such as ..\ or ../ in arguments passed to sync_icon or in application logs.
Unexpected reads of sensitive files such as configuration or credential files by the icons synchronization process.

Detection Strategies

Review application logs for calls to scan_project_icons/sync_icon with icons_file arguments containing .., absolute paths, or non-icon file extensions.
Instrument the affected function to log the resolved canonical path and compare it against the expected base directory.
Perform static analysis of dependent projects to identify use of better-auth/better-icons versions 1.0.5 or earlier.

Monitoring Recommendations

Enable filesystem auditing on directories adjacent to the icons folder to catch unexpected access from the application process.
Alert on process file-open telemetry that shows the better-icons binary or module accessing paths outside its working directory.
Track dependency inventories for better-auth/better-icons to identify vulnerable installations across development environments.

How to Mitigate CVE-2026-15527

Immediate Actions Required

Inventory projects that depend on better-auth/better-icons and identify installations at version 1.0.5 or earlier.
Restrict local access to systems running the affected component to trusted users only.
Avoid passing user-influenced input to the icons_file argument of sync_icon until a fix is available.

Patch Information

No vendor patch has been released at the time of publication. According to the VulDB CVE-2026-15527 Entry, the maintainers were notified through the GitHub Issue #18 Discussion but have not responded. Monitor the GitHub Repository for Better Icons for future releases addressing this issue.

Workarounds

Wrap calls to sync_icon with input validation that rejects any icons_file value containing .., backslashes, or absolute path prefixes.
Enforce a canonical base directory check by resolving the input path and verifying it is a descendant of the intended icons folder before use.
Run the application under a least-privilege account to limit which files the process can access if traversal succeeds.
Consider forking the library and applying a local fix if upstream remediation is delayed.

bash

# Configuration example - validate icons_file input before invoking sync_icon
# Reject traversal metacharacters and absolute paths
case "$ICONS_FILE" in
  *..*|/*|*\\*) echo "Invalid icons_file path"; exit 1 ;;
esac